Full Report
The Computer Emergency Response Team of Ukraine (CERT-UA) has disclosed details of a new social engineering campaign orchestrated by Russian nation-state threat actors targeting IT workers in the country by masquerading as recruiters to trick them into installing malware. CERT-UA pinned the activity on a threat cluster it tracks as UAC-0145, which is a subgroup within Sandworm (aka APT44,
Analysis Summary
# Threat Actor: UAC-0145
## Attribution & Identity
* **Identification:** UAC-0145 is a specialized threat cluster or subgroup.
* **Known Aliases:** A subgroup within **Sandworm** (also known as **APT44**, **Seashell Blizzard**, and **UAC-0002**).
* **Affiliation:** Russian nation-state actors affiliated with the Main Directorate of the General Staff of the Armed Forces of the Russian Federation (**GRU**).
## Activity Summary
Since May 2026, UAC-0145 has been conducting a sophisticated social engineering campaign targeting IT professionals in Ukraine. The actor poses as recruiters from legitimate firms (e.g., ATLAS Business Group or Sopra Steria Bulgaria) on job search platforms. After establishing rapport via Telegram and conducting a live video interview—potentially using AI-generated synthetic personas—the actor tricks candidates into installing a poisoned VPN client under the guise of a technical assessment.
## Tactics, Techniques & Procedures
* **Social Engineering:** Uses fake job recruitment lures, professional chat platforms, and live video interviews to build trust.
* **AI Personas:** Possible use of AI-generated synthetic personas during Zoom interviews to mimic English-speaking recruiters.
* **Malicious Software Modification:** Recompiled the open-source WireGuard VPN client to include a "SymmetricKey" option for command execution.
* **Command Execution via VPN:** Uses the `PostUp` option within the WireGuard configuration to trigger a `runScriptCommand` mechanism.
* **Persistence:** Creates scheduled tasks via PowerShell to download subsequent payloads.
* **Platform-Specific Payloads:** Utilizes PowerShell for Windows targets and cURL for Linux targets.
**MITRE ATT&CK IDs mentioned/implied:**
* **T1566.003:** Phishing: Spearphishing via Service (Telegram/Job sites)
* **T1588.002:** Obtain Capabilities: Tool (Modified WireGuard)
* **T1053.005:** Scheduled Task/Job: Scheduled Task
* **T1059.001:** Command and Scripting Interpreter: PowerShell
* **T1204.002:** User Execution: Malicious File
## Targeting
* **Sectors:** Information Technology (IT) and Software Consulting.
* **Geography:** Ukraine.
* **Victims:** IT workers, specifically System Administrators and IT Specialists. Impersonated organizations include ATLAS Business Group and Sopra Steria Bulgaria.
## Tools & Infrastructure
* **Malware:**
* **SopraVPN:** A "poisoned" version of the WireGuard VPN client.
* **Secondary Payloads:** Undisclosed malware downloaded via PowerShell or cURL.
* **Infrastructure:**
* **SourceForge:** Used to host malicious projects:
* `sourceforge[.]net/projects/soprabulgariavpn`
* `sourceforge[.]net/projects/sopravpn`
* `sourceforge[.]net/projects/soprasteriavpn/`
* **Look-alike Domain:** `soprasteria-bg[.]com` (mimicking a legitimate European consulting firm).
* **Messaging:** Telegram for operational communication.
* **Conferencing:** Zoom for conducting fake interviews.
## Implications
UAC-0145 demonstrates a high level of operational maturity by combining traditional social engineering with technical supply chain-style attacks (modifying legitimate open-source software). By targeting system administrators, the actor seeks high-privilege access to corporate networks. The potential use of AI synthetic personas suggests a new evolution in Russian information operations designed to bypass the "uncanny valley" and human intuition during recruitment-themed lures.
## Mitigations
* **Managed Devices:** Enforce policies that allow access to corporate resources only from organization-managed devices with pre-installed security stacks.
* **Software Verification:** Prohibit the installation of VPN clients or technical tools from unverified third-party sources like SourceForge for recruitment assessments.
* **Personnel Awareness:** Train IT staff to recognize "recruitment" lures that shift quickly from professional platforms to Telegram and require the installation of custom software for "testing."
* **Endpoint Monitoring:** Monitor for unusual `PostUp` commands in WireGuard configurations and unauthorized PowerShell scheduled task creation.